Description (CNA)
Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administration commands in SAP NetWeaver and ABAP Platform - versions KERNEL 7.49, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, KRNL64NUC 7.49, KRNL64UC 7.49, SAP_ROUTER 7.53, 7.22, from a remote client, for example stopping the SAProuter, that could highly impact systems availability.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| SAP SE / SAP NetWeaver and ABAP Platform | affected KERNEL 7.49; affected 7.77; affected 7.81; affected 7.85; affected 7.86; affected 7.87; affected 7.88; affected KRNL64NUC 7.49; affected KRNL64UC 7.49; affected SAP_ROUTER 7.53; affected 7.22 |
CWE
CWE-863
References
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
- https://launchpad.support.sap.com/#/notes/3158375
- http://seclists.org/fulldisclosure/2022/Sep/17
- http://packetstormsecurity.com/files/168406/SAP-SAProuter-Improper-Access-Control.html
ADP enrichment
No English description supplied.